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BACKGROUND 

Field of the Invention: 

The present invention relates to the field of aircraft flight control and, more 
particularly, emergency flight control. 

Related Art: 

The attacks on United States soil by terrorist forces on September 11, 2001 using 
domestic aircraft indicate that present airport security is inadequate and may never be 
adequate to prevent another hijacking. Airline security may be enhanced by a mechanism 
that deters would-be hijackers because attempted hijacking would become futile. Such a 
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mechanism is not only applicable for domestic non-military aircraft in the United States, 
but also may deter terrorists from attempting a hijacking anywhere in the world. Early 
weapon detection and other prevention techniques may prevent hijackers from boarding 
an aircraft, but once the aircraft is airborne with weapons aboard, all the prevention 
5 systems and techniques are ineffective. Consequently, detection of carried-on weapons 
and other prevention techniques may never be capable of preventing the forced takeover 
of an aircraft. 

While detecting the presence of some weapons carried by would-be airline 
."p passengers is possible, weapons can be made from not only disassembled components 

10 being reassembled, but also from parts of the interior of the aircraft. Airport security 

in 

H= metal detectors and other screening methods are not capable of entirely detecting such 
^ weapons. Further, once a terrorist has taken over the aircraft, all detection systems then 
£ become questioned in their accuracy and detection methods. 

j 

l/} The airport detection methods and apparatus, while improved, are subject to the 

U 15 varying skill level and attentiveness of the security attendants at any particular airport. 
Multiple passes through such detection systems indicate inherent flaws in accurately 
detecting weapons. For instance, a first pass through a metal detector may indicate that a 
person has sufficient metal content to trigger a positive no-go signal on a go/no-go signal 
standard, which is usually represented by an audible tone alerting the attendant to a 
20 potential problem. The person then removes his or her watch, which may or may not be 
the source of the positive trigger, and then re-passes through the metal detector not 
setting-off the go/no-go signal although the metal detection signal strength falls just short 
of a pre-set trigger level. Further, each metal detector may be calibrated to a slightly 
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different scale, thereby allowing some higher metal content to pass through some 
detectors while not passing through others. Even considering a perfect metal detector 
scheme, such machines may not be capable of picking up plastic, ceramic, or other 
weapons and sub-assemblies. Like the metal detection systems, carry-on baggage 
5 detectors are subject to human skill and alertness. Human errors in detecting weapons 
either on-passenger or in carry-on luggage have the potential of allowing dangerous 
weapons in the passenger compartment of aircraft. 

While the hijacking of commercial aircraft requires immediate attention and 

O 

iB correction, aircraft safety is also affected by incapacitated flight crews. For example, 

tjj 

yQ 10 pilots may suffer sudden health problems. For instance, a pilot may suffer a heart attack 
H in-flight and, unbeknownst to other flight crew, if any other crew exists, the aircraft may 

~ veer off-course or dive from present altitude. While autopilot, if available in the present 

[7 system, may be engaged in such a situation, the autopilot may require periodic inputs 

ig from the pilot. Also, autopilot may not include autoland sequencing, which may require 

M 15 additional inputs from the pilot or co-pilot, if any. If a pilot suffers a heart attack, a 
seizure, or another incapacitating event, the pilot may not be able to respond to the 
required periodic or queried inputs. A mechanism that allows external, i.e. non-piloted 
input, functional control of the aircraft thus can increase the safety of the passengers and 
crew of the aircraft, and can protect against destruction of property. 

20 Another situation arises if the aircraft automatic and/or manual controls break or 

malfunction. The pilot may not have the ability to correctly fly the aircraft, creating a 
potential for devastation. Although many aircraft are “fly-by-wire” and incorporate both 
redundant mechanical and electrical systems to protect against failure, these systems still 
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require wiring systems and interconnects that may prevent the pilot or other persons from 
controlling the aircraft. A mechanism for externally controlling the aircraft, when pilot 
intervention is severed provides protection in instances as described above. 
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SUMMARY 


A method and system for preventing control of an aircraft from the cockpit is 
disclosed. In an exemplary embodiment, the system could be triggered internally or 
externally. For example, an air traffic control (ATC) station could determine that the 
5 aircraft has deviated from its planned flight path. If personnel or equipment at the ATC 
station decide that the deviation is not attributable to the actions of the authorized flight 
crew, the personnel or equipment can transmit a signal to the aircraft that disables all of 
the normal cockpit flight controls of the aircraft. Once normal flight controls are 

O disabled, the aircraft may execute a preprogrammed emergency flight plan via its 

» 10 autopilot system, with or without the use of a flight management system (FMS). The 

L: j 

| S 

Zl emergency flight plan could cause the aircraft to fly to a sparsely populated area and 

5 — 

n enter a holding pattern, or it could cause the aircraft to land in a sparsely populated area 

M or at an airport using an autoland system. 


McDonnell Boehnen 
Hulbert & Berghoff 
300 South WackerDrive 
Chicago, Illinois 60606 
Tel: 312-913-0001 
Fax: 312-913-0002 




BRIEF DESCRIPTION OF THE DRAWINGS 


An exemplary embodiment is described herein with reference to the drawings, in 

which: 

Figure 1 is a simplified diagram of an aircraft in which an exemplary embodiment 
5 may be implemented; 

Figure 2 is a simplified diagram of a signal transmission system that could trigger 
a system in accordance with the exemplary embodiment; 

Figure 3 is another simplified diagram of a signal transmission system that could 
^ trigger a system in accordance with the exemplary embodiment; 

J 10 Figure 4 is a simplified block diagram illustrating several components that may 

m _ . • 

M= provide functionality according to an exemplary embodiment; 

l TS 

0 Figure 5 is a flow chart depicting functions performed in accordance with the 

H exemplary embodiment; and 

Figure 6 is another flow chart depicting functions performed in accordance with 

■Sff 

r: 15 the exemplary embodiment. 
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DETAILED DESCRIPTION 


Fig. 1 is a simplified conceptual block diagram illustrating an emergency flight 
control system 100, according to an exemplary embodiment of the present invention. 
Although illustrated in the context of a commercial airliner, various embodiments may be 
5 applied to other transportation environments, such as other aircraft types, watercraft, or 
land vehicles. Accordingly, the present application is intended to encompass these 
additional embodiments and others. 

The system 100 includes a flight control system 102, which may normally receive 
^ inputs from a cockpit control 104. Based on the inputs from the cockpit control 104 and 
2 10 possibly other inputs, the flight control system 102 may control such items as one or 

| R 

N= more engines and/or control surfaces, such as flaps, rudders, etc. The emergency features 

□ of the system 100 may be initiated through an activator 108 providing an activation 

trigger to the flight control system 102. When the activation trigger is received at the 
= M flight control system 102, the flight control system enters a special reversionary mode 

ft 15 and the cockpit controls 104 are disabled, such as by a switch 110 or other 

disabling/cutoff circuit. Switch 110 may be a functional, rather than a physical, entity. 
For example, switch 110 may be implemented as a set of logic instructions in a flight 
control computer or system that causes cockpit flight control inputs to be ignored, even 
though they are still received. As a result of receiving the activation trigger, subsequent 
20 flight is controlled according to the special reversionary mode, rather than by the 

aircraft's crew. Further details regarding the special reversionary mode may be found 
below. 
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The flight control system 102 may be comprised of a single unit, or it may be 
composed of several interconnected units. Examples of functional components and/or 
systems that may be included within an exemplary flight control system 102 include a 
digital or analog chronometer, an advanced flight control system, a thrust mode control 
5 panel, navigation sensors and systems such as an inertial reference system, distance 
measuring equipment, an instrument landing system an automatic direction finding 
system, etc. Flight control system 102 could also include a maintenance control and 
display panel, one or more engine indication/crew alerting system computers, autopilot 
u3 flight director system computer(s), flight management computers, a thrust management 
Cj 10 system, etc. Such components may provide one or more of the following: warning 

w i 

r! annunciations and messages, basic flight and navigation information, flight control and 
steering commands, guidance navigation performance, thrust control, and flight, mode, 
y and navigation display information. Autopilot, autoland, and/or related systems may be 

Sj included. Similarly, one or more of the components or systems described above may be 

S 

N= 15 omitted from the flight control system 102 without departing from the intended scope of 
the present invention. 

The cockpit control 104 acts as the pilot interface to the flight control system 102. 
During normal flight operation, the flight crew of the aircraft may be responsible for 
controlling the flight of the aircraft. An autopilot system may also be employed to 
20 provide flight control during various flight portions. Such an autopilot system may 
require pilot programming and/or periodic intervention to ensure proper operation. 

During normal operation, only a flight crew has access to the cockpit controls. During an 
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emergency situation, such as an attempted hijacking, unauthorized persons may attempt 
to operate the cockpit controls. 

The engine and/or control surfaces 106 may be used to control the aircraft. The 
flight control system 102 may provide signals to increase or decrease engine speed, for 
5 example. Steering may be accomplished through actuated control surfaces. Other 

functions besides control of engine and control surfaces may be performed by the flight 
control system's output 106. 

The activator 108 may take on one or more alternative forms in order to provide 
the activation trigger to the flight control system 102. For example, the activator 108 
ifl 10 ma y be manually initiated, such as by an aircraft’s crew members (e.g., pilots, flight 

5 s=s 

y! 

H attendants). Similarly, an air traffic controller may provide the activation trigger to the 

n i 

flight control system 102 via a wireless data link. The activation trigger may also be 
[7 provided by a chase plane, for example. In another alternative embodiment, the activator 
108 could be automatic or partially automatic, based on sensed conditions (e.g. loss of 
j~ 15 cabin pressure, absence of a pilot’s pulse or breathing, etc.). Many other alternatives are 
possible. Preferred implementations involve schemes that are not easy to accidentally 
trigger. Therefore, a cabin compartment activator would preferably take the form of a 
keypad for entry of a code, rather than a single button that could accidentally be pressed, 
although such an implementation is still intended to be within the scope of various 
20 embodiments of the present invention. In addition, safety mechanisms may be provided 

to prevent inadvertent activation. For example, a validating process could be provided to 
verify the validity of the activation trigger. 
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The switch 110 is shown as one means for disabling cockpit control of the flight 
control system 102 when the activation trigger is received from the activator 108. As an 
alternative to the scheme illustrated in FIG. 1, the activator 108 may directly control the 
switch 110 (or other disabling mechanism). Disabling the cockpit control 104 may 
5 prevent an unauthorized user, such as a hijacker, from operating the aircraft. Similarly, 
should the flight crew become incapacitated, the disabled cockpit control 104 may allow 
for automatic aircraft operation, which may be more favorable than attempts by 
remaining crew or passengers to operate the aircraft. 

% The special reversionary mode described above may take on one of several forms. 

io Upon disabling control of the aircraft from the cockpit, control may be transferred to 

; 

H= another entity, such as a pre-programmed flight plan or an external control entity (e.g. an 

□ air traffic control center, an airline's operations control center, or a pilot in another 

aircraft). 

J/t According to one embodiment, on-board avionics equipment reverts to a 

’M 

SSS. 

tl 15 predetermined emergency flight plan. Such a flight plan may, for example, navigate the 
aircraft to a "safe zone." In the embodiment, the emergency flight plan may immediately 
begin descent or ascent to a safe altitude and upon arrival at the safe zone, enter a holding 
pattern. Executing a holding pattern would permit another aircraft to approach the 
aircraft in an attempt to assess the situation. Several safe zones could be defined and 
20 could include areas over water or sparsely-populated land areas. The nearest safe zone 
could be automatically selected based on the aircraft’s present position, according to an 
exemplary embodiment. Position may be determined by an inertial navigation system, a 
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global positioning system, or a ground-based system, or a combination of these, for 
example. 


According to another exemplary embodiment, control of the aircraft may be 
transferred to a system external to the aircraft, such as an air traffic control entity. This 
5 could be a ground-based system or a system on board another aircraft (e.g., a "chase 
plane"). The external control could be used to direct the disabled aircraft to a safe zone 
or suitable landing site. A properly equipped aircraft could be commanded to execute an 
automated or partially automated landing via external control or a preprogrammed ^ 

J emergency flight plan. 

.j=t 

iH 10 The system could also be designed to allow cockpit control of the aircraft to 

H resume once an emergency has subsided. Any method or system used to verify a request 

n i 

U for resumption of normal control of the aircraft could be used. For example, an aircraft 

j~ crew member could enter a special code on a keypad or speak a particular command into 

Lj a voice recognition system. Normal control could also be resumed after a predetermined 
L* 15 time period has elapsed, or after the aircraft has flown to a particular area (e.g., a sparsely 
populated, relatively safe area). In the event that a crewmember is coerced into causing 
cockpit control to resume, an external activation trigger as described above could simply 
cause the reversionary mode to be entered again. It would also be possible to lock out 
any resumption of normal cockpit control if such control has been attempted one or more 
20 times and the aircraft has not resumed an authorized, safe, or expected flight path under 
cockpit control, thus preventing a hijacker from coercing a crewmember into allowing the 
hijacker to regain control of the aircraft. 

Remote monitoring of the aircraft’s instruments 
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Aircraft and air traffic control (ATC) typically communicate with each other in 
several different ways. The pilot and ATC are in contact by voice communication. Also, 
ATC usually monitors the aircraft through radar. The radar provides information on the 
aircraft’s ground speed, ground track and altitude. 

5 Additionally, commercial passenger aircraft often employ an aircraft 

communication addressing and reporting system (ACARS). This system is typically used 
by an airline’s control center to receive maintenance information about the aircraft. 
ACARS is typically a one-way link, but may also be implemented as a two-way link. 

% One limitation of the radar and ACARS systems is that they typically do not provide 
.r 10 information from the aircraft’s flight control system. It is possible to implement 
M. additional systems that provide more complete information, such as position, direction, 

f% \ 

□ air speed and information about the aircraft’s control settings, like flaps settings, landing 

rf gear position and engine power settings. It is also possible to attach a transmitter to the 

LI aircraft (or utilize an existing transceiver) to communicate this additional information. 

JT 15 Remote triggering 

In one embodiment an ATC such as ATC 400 (FIG. 2) may send a signal 402 to 
an aircraft, such as aircraft 404, to trigger the system 100. In another embodiment the 
system 100 can be triggered by a control center for the airline, such as an airline's 
ACARS 406. 

20 As shown in FIG 3, a chase plane 408 could also trigger the system by sending 

signal 402-a to aircraft 404. This embodiment would allow chase plane 408 to approach 
aircraft 404 and assess the situation before making the decision to trigger the system, 
thereby reducing the possibility of making an erroneous triggering decision. Triggering 
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from a chase plane would be advantageous because a shorter distance between the 
transmitter and the aircraft’s receiver would allow for implementation with a weaker 
transmitter or receiver, and it would reduce the possibility of outside interference with the 
signal, thereby increasing security. 

5 As further shown in FIG. 3, signal 402-b could be sent to aircraft 404 from a 

satellite 410. 

A remote signal such as signal 402, 402-a, or 402-b can be sent to the aircraft 
through any number of traditional communications methods. It can be sent using various 

15 frequencies, such as UHF or VHF, for example. In an exemplary embodiment, the link 

. 

10 between the remote transmitter and the aircraft may be encrypted. Encryption is a 
H method through which an original signal is altered according to a known format and sent 
w to another location. When it arrives at the second location the signal is restored to its 
r[ original form using a secret key. Only an entity possessing the secret key can restore the 

L5 encrypted signal to its unencrypted, original form. This process provides data security by 

U 15 preventing others from acquiring the encrypted signal, converting it back to its 

unencrypted form and reading the original message. The use of encryption also prevents 
others, who do not have the secret code, from intentionally or unintentionally sending 
signals to the aircraft that trigger the system. 

Encryption can be implemented using any number of known methods, such as 
20 asymmetric (public-key) encryption or symmetric encryption. It is possible to use one or 
more methods in an implementation. Using multiple encryption methods, for instance at 
difference frequencies transmitted to the aircraft, can provide additional redundancy and 
security to the aircraft. 
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In an exemplary embodiment, the remote link between the transmitter and the 
aircraft may be digital. The use of a digital signal has advantages over using an analog 
signal. Digital signals provide better noise rejection and reduce outside interference with 
the signal. This prevents the system from misinterpreting the signal and performing an 
5 erroneous action or from not understanding the signal and performing no action. 

Remote control 

Once the system 100 is triggered from a remote location, or from within the 
aircraft, it may be possible to control the aircraft remotely through a remote 
^ communication link, according to various embodiments. 

jj 10 In one embodiment the remote communication link sends data to one of the 

N= aircraft’s systems that causes the aircraft to fly in a preprogrammed flight pattern. 

j 

O In another embodiment the remote communication link can be used to send a 

f* newly selected flight path to the aircraft. 

A further embodiment allows the aircraft to be flown remotely in real-time. Full 
2 15 control of the aircraft’s engines, flaps, landing gear and other systems rests in a remote 
pilot. The aircraft could be flown remotely using the basic information provided by 
ATC’s radar, or, for more precision, the system can implement means to provide the 
remote fliers with additional flight information. 

The remote control of the aircraft can be used to fly the aircraft away from a 
20 heavily populated area. The aircraft could be flown to location to be landed or it could be 
taken to a location (such as over water or a deserted area) to be crash-landed. These 
options allow the people controlling the aircraft remotely to select the best course to 
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safely aid the people on the aircraft while minimizing the danger to other people on the 
ground. 


Remote control of the aircraft can be obtained in several different ways. The 
remote link can send information to the aircraft’s flight management system (FMS). 

5 Control can also be achieved by communicating directly with the aircraft’s autopilot 
system. 

In one embodiment, the remote link communicates directly with the aircraft’s 
flight control computer. One advantage of this implementation is that it can be used on 

2 an aircraft that doesn’t have an FMS. Another advantage is that this system would be 

. P. 

ift 10 harder to disable than one that communicates with the FMS. The flight control computer 

| ps 

r* is typically further removed from access by the human operators than the FMS. This 

| Li 

y would make it more difficult for those on the aircraft to disable the system. 

3_Ju 

jj Another embodiment allows the system to be remotely deactivated. This is 

Lj desirable if the system was mistakenly activated or if a change in circumstances no longer 

£1 15 warrants using the system. Deactivation from the aircraft is possible, but not preferred, 
due to the possible ability of a hijacker to deactivate the system. 

Turning now to FIG. 4, another exemplary embodiment of the present invention is 
shown. In this exemplary embodiment, automatic activation of the flight control system 
102 may occur. Thus, the flight control system 102 may take control of the engine and/or 
20 control surfaces 106 in response to a dangerous condition that occurs aboard the aircraft. 
For example, a loss of cabin pressure at a high altitude (e.g., 30,000 ft.) may deplete the 
amount of oxygen present in the aircraft and incapacitate the flight crew. In this instance, 
a pressure sensor 502 on the aircraft may detect the lowered pressure and serve as the 
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activator 108 to activate the flight control system 102. For example, the damage sensor 
504 may be a vibration sensor to detect vibrations caused by a damaged aircraft 
component. The flight control system 102 may then cause the aircraft to descend rapidly 
to an altitude where more oxygen is present (e.g., 10,000 ft.). 

5 Furthermore, the aircraft may have a damage sensor 504 that detects damage to 

the aircraft. For example, damage to the aircraft may be caused by a bird or other animal, 
a missile, another aircraft, a stationary object, or a sudden maneuver by the aircraft. In 
these instances, the damage sensor 504 could detect the damage to the aircraft and 
B activate the flight control system 102. The flight control system 102 may then cause the 
10 aircraft to begin an emergency procedure, such as flying in a holding pattern, attempting 

; sk 

f; a crash landing, or landing at a nearby airport. It should be understood that the examples 
1=5 described in this exemplary embodiment are intended to illustrate, not limit, the spirit and 

y scope of the present invention, and that damage to the aircraft and the response to such 

fy damage may occur in a variety of ways. 

Q 15 In addition, automatic activation of the flight control system 102 may also occur if 

: j. 

5— 

the aircraft undergoes a sudden maneuver. For example, if the aircraft suddenly dives 
towards the ground, a motion (or acceleration) sensor 506 may detect this movement and 
activate the flight control system 102. The flight control system 102 may then ease the 
aircraft’s descent and send the aircraft into a holding pattern. It should be understood that 
20 a wide variety of sudden maneuvers may occur that trigger the automatic activation of the 
flight controller, such as, but not limited to, dives, sudden banks or rolls, and spins. 
Preferably, maneuvers normally executed during the course of a typical flight will not 
provide the activation trigger. 
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r 


Automatic activation of the flight control system 102 may also occur if the 
engines and/or control surfaces 106 of the aircraft malfunction. Preferably, the aircraft 
has an engine sensor 508 and a control surfaces sensor 510 to detect dangerous changes 
in the engines and control surfaces, respectively. For example, the engine sensor 508 
5 may detect if one engine breaks down and notify the flight control system 102. The flight 
control system 102 may then utilize the remaining engines to begin an emergency 
procedure, such as flying in a holding pattern, attempting a crash landing, or landing at a 

nearby airport. Likewise, if a control surface such as a rudder or aileron malfunctions, 

O 

Ti the control surfaces sensor 510 may activate the flight control system 102. The flight 

*0 10 control system 102 may then begin an emergency procedure such as an attempted 

in 

M landing. 

□ According to various embodiments, automatic activation of the flight control 

f“ system 102 may occur when a malfunction has occurred aboard the aircraft, or when the 

L/l aircraft has been damaged. Thus, it may be acceptable in some circumstances to maintain 

“4 

y 15 an override mechanism 560 that the pilot may activate when the pilot believes he or she 
can handle the dangerous situation better than the flight control system 102. The flight 
control system 102 may differentiate between automatic activation as opposed to manual 
activation and the remote activation discussed previously, and the override mechanism 
560 may only be operable in an automatic activation scenario. It should further be 
20 understood that many alternate embodiments exist that lie within the spirit and scope of 
the present invention, and that other sensors and configurations may be used. As another 
alternative, automatic activation may occur due to the aircraft failing to respond to or 
heed signals sent from ATC. 
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Figure 5 is a flow diagram illustrating a method for providing emergency flight 
control. The aircraft receives an activation trigger, step 600. The activation trigger is a 
signal from inside or outside the aircraft to begin the process of engaging the system to 
take operational control away from those onboard the aircraft. When the remote 
5 activation trigger is received, the system activates a special reversionary mode shown at 
602. The special reversionary mode may, for example, automatically control the aircraft 
according to one or more preprogrammed flight patterns. It may also control the aircraft 
from a remote location by sending the aircraft a determined flight plan or by controlling 

Q the aircraft in real-time. 

10 As shown at step 604, the cockpit flight controls may be disabled. Disabling the 

Z1 onboard flight controls prevents a person aboard the aircraft from controlling its 

m 

n operations and defeating the automatic or remote control. 

In another embodiment the cockpit flight controls are disabled before the special 

i ; 

FU reversionary mode is activated. It is preferable, however, that only a short delay occurs 

GSS 

15 between disabling the flight controls and activating the special reversionary mode. 

Figure 6 is a flow diagram illustrating an exemplary operation of an emergency 
flight control system. As shown at 700, the crew triggers the system. This may be 
through the use of one or more devices on the aircraft, such as a button or combination of 
buttons, or through any other method of sending a signal. Alternatively, the system is 

20 activated by an external trigger, illustrated at 702. The external trigger can be a signal 
sent from a remote location. The location may be from ATC, a control center of the 
aircraft’s airline, a government facility, a chase plane or another location. The signal 
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may be a digital or analog communication signal. It may be sent using any number of 
available frequencies, such as UHF or VHF. Encryption may also be used. 

Step 704 illustrates activation through an automatically generated trigger. This 
trigger may originate from the aircraft’s flight management system, flight control 
5 computer, or another device. An event, such as a deviation from an intended flight 
pattern, an explosive decompression of the cabin, a sudden loss of altitude or an erratic 
flight path may be programmed to trigger the system. Other events, or a combination of 
events, may also be used to trigger the system. 

p Once the activation trigger is generated, it is received by the system, as shown at 

yj 10 step 706. Upon receipt of the signal, the system must make an election regarding control 

,ri 

yi of the aircraft, as shown at step 708. If the signal does not request external flight control, 

% then the system may execute a preprogrammed flight plan, as shown at step 710. The 

preprogrammed flight plan may be stored in the aircraft’s autopilot, flight management 
hj system, flight control computer, or at another location. A signal that is generated 

p 15 internally, like the crew-generated trigger, likely would not request external fight control, 
because the signal is not being generated from a remote location having equipment and/or 
personnel (e.g., ATC center) that could control the aircraft. Likewise, an automatically 
generated trigger likely might not request external flight control because it is also a signal 
originating internally. 

20 If the signal or trigger does “request” external flight control, the system must 

additionally determine if the external control of the aircraft should be via autopilot, as 
shown at step 712. If the signal requests the use of autopilot, the entity sending the signal 
may also transmit a flight plan to the aircraft, as shown at step 714. The flight plan may 
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be updated one or more times during the operation of the system. This allows ground 
controllers to change the path of the aircraft as changing circumstances may warrant. 

In another implementation, the signal may be used to generate external control via 
a two-way communications link with the aircraft, as shown at step 716. In this 
5 implementation a pilot in a chase-plane may be able to remotely fly the aircraft in real¬ 
time while receiving various data from the aircraft. In a preferred embodiment, the two- 
way communications link sends information about the aircraft’s control settings, engine 
power level, fuel level, landing gear position, air speed, and any other necessary or 
~ desirable information to the remote location where the information may be used in flying 

t LJ 

10 the aircraft. 

dJ 
I n 

|=i As shown at step 718, the aircraft may, subsequent to receiving an activation 

O trigger, receive a deactivation trigger. A deactivation trigger could be generated within 
or outside of the aircraft once authorized personnel determine that a hijacking or other 
danger to the aircraft no longer poses a threat. The deactivation trigger could be 
15 generated either in-flight or after the flight has safely ended. As an example, a member 
or members of the crew could enter a password on a keypad to deactivate the system 
while in flight; a weight-on-wheels or airspeed indication could also be used to determine 
that the aircraft has landed, resulting in a deactivation trigger being generated. 

In the event that a hijacker forces a crewmember to deactivate the system, the 
20 process of activating the system as described above could simply be repeated upon 
external or onboard detection of an unauthorized deviation from an expected or safe 
flight path. In such an event, it would also be possible to lock-out future attempts to 
deactivate the system while the aircraft is still in flight. 
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At step 720, if the system receives a deactivation trigger, cockpit control of the 
aircraft may be re-enabled, and the special reversionary mode could be disabled (step 
722). 

Embodiments of the present invention may be implemented using some 
5 components from current aircraft. For example, positioning equipment, such as inertial 
reference and GPS, combined with a Flight Management System (FMS) provide 
navigation and can be coupled with systems to fly an aircraft along a pre-programmed 
course. According to embodiments of the present invention, the FMS system could be 
modified to revert to an emergency flight plan or to accept an emergency flight plan from 
10 an external command source. Communications between the FMS and the external entity 
could be provided using navigation-band and/or communication-band radios, satellite 
communications (e.g. SATCOM), and/or other communication systems. Security and 
authentication may be implemented using encryption techniques and equipment. In an 
alternative embodiment, Category III autoland capabilities may be utilized to safely land 
15 a hijacked aircraft in an emergency situation. In another alternative embodiment, a 
collision avoidance system may be used, such as to inform nearby aircraft that a 
reversionary mode has been entered. 

Exemplary embodiments of the present invention have been illustrated and 
described. It will be understood, however, that changes and modifications may be made 
20 to the invention without deviating from the spirit and scope of the invention, as defined 
by the following claims. 
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